61c8de3128ca4893324f3327d8ca941e089dcc42eb0d2e6ef98616f5402234d5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.bin.exe
Size 54.0MB
Sample260430-p83rtah19l
SHA256 61c8de3128ca4893324f3327d8ca941e089dcc42eb0d2e6ef98616f5402234d5
MD5 2435ae249a447a17abd6ff2dace1ddf8
SHA1 cb8c7179f7bfc6a4ac028a305205f55e8df38cf5
SHA512 00f0fc01ca7bd9eceb154a667e51f8475890ae7683a1e2489863ec673645dfd8f69d104bf0057eb8c469e4809725751b1d9ef7bac35270b030c2be060174c740
SSDEEP 1572864:6ZT5vQnGbS5OtUIYjFbUTtp3+ngP5VsVkRLT:6ZTVLZuFbQlPjs+RLT
TLSH
T197C7333BF19A993FD12597717AB39160553BB910A4028C4692ECF8C8CF791B11E3F68B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
1852	a.bin.tmp
4996	Grape.exe
640	Grape.exe
3968	Grape.exe
480	Grape.exe
3944	Grape.exe
4284	Grape.exe
2808	Grape.exe
564	Grape.exe

Loads dropped DLL 14 IoCs

pid	Process
4996	Grape.exe
640	Grape.exe
640	Grape.exe
640	Grape.exe
640	Grape.exe
3968	Grape.exe
480	Grape.exe
3944	Grape.exe
3944	Grape.exe
3944	Grape.exe
3944	Grape.exe
4284	Grape.exe
2808	Grape.exe
564	Grape.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\QuickCoreQuickCore\\Grape.exe"	Grape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\QuickCoreQuickCore\\Grape.exe"	Grape.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.bin.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2400-1-0x0000000000100000-0x00000000001E9000-memory.dmp	innosetup
behavioral2/memory/2400-335-0x0000000000100000-0x00000000001E9000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3968	Grape.exe
3968	Grape.exe
4284	Grape.exe
4284	Grape.exe
2808	Grape.exe
2808	Grape.exe
564	Grape.exe
564	Grape.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1852	2400	a.bin.exe	79
PID 1852 wrote to memory of 4996	1852	a.bin.tmp	80
PID 4996 wrote to memory of 640	4996	Grape.exe	82
PID 4996 wrote to memory of 640	4996	Grape.exe	82
PID 4996 wrote to memory of 3968	4996	Grape.exe	84
PID 480 wrote to memory of 3944	480	Grape.exe	86
PID 480 wrote to memory of 3944	480	Grape.exe	86
PID 480 wrote to memory of 4284	480	Grape.exe	87
PID 4996 wrote to memory of 2808	4996	Grape.exe	89
PID 480 wrote to memory of 564	480	Grape.exe	90

C:\Users\Admin\AppData\Local\Temp\a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\a.bin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\is-5P3OI0DWMB.tmp\a.bin.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5P3OI0DWMB.tmp\a.bin.tmp" /SL5="$A0060,55372638,893952,C:\Users\Admin\AppData\Local\Temp\a.bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
    "C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
      "C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe" --type=gpu-process --field-trial-handle=1760,10357721617184976261,11147643866959941,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1768 --ignored=" --type=renderer " /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:640
  - - C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
      "C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe" --type=utility --field-trial-handle=1760,10357721617184976261,11147643866959941,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2144 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3968
  - - C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
      "C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe" --type=gpu-process --field-trial-handle=1760,10357721617184976261,11147643866959941,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1804 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2808

C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:480
- C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
  "C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe" --type=gpu-process --field-trial-handle=1800,2230862475722650156,6901766427388549996,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1816 --ignored=" --type=renderer " /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3944
- C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
  "C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe" --type=utility --field-trial-handle=1800,2230862475722650156,6901766427388549996,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe
  "C:\Users\Admin\AppData\Local\QuickCoreQuickCore\Grape.exe" --type=gpu-process --field-trial-handle=1800,2230862475722650156,6901766427388549996,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1208 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\chrome_200_percent.pak
Size 312KB
SHA256 cd584f20aeed80fe5852d5d5656a12d25d9116d6b805ddbec3874d310925df2a
MD5 bd66e8de6979dfe12cbaa29390d11a64
SHA1 967916eb7587f0163fbce50c7b4822d06e939d5a
SHA512 f77bd5004d8da54e8588ffcf6962b3244b8e4a9f6310d31f0c7c44d913504577c9e3fb858078705c384649fbcf26223d8f98dd02778e259a8924028f2be3bc1c
SSDEEP 6144:8DQYaR+9bITNNz73QYV85u/oFYvwoytKi6obByPGlPFYKKo+:RfIITDg5u/oFFpxLlFYb
TLSH
T1C064F1E6F3F4AC3CE9971E3351560AA3DD7711350AB7434AC28AAC343D56B9489C938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\d3dcompiler_47.dll
Size 4.3MB
SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
MD5 fea40e5b591127ae3b065389d058a445
SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
TLSH
T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\ffmpeg.dll
Size 2.2MB
SHA256 1a5ea394d48ec44bdffc87a0a414553acd7496058546fda51f2aa7afc774d277
MD5 8b9523d7903086ac856883180ebacb62
SHA1 2dd60ab51c395faee96d3ce88936124c6cb8cdb1
SHA512 5047265d676c0422d48466fd670f406e4cadb1f673b3caca14fe475e710949f8daae3acf4ed59a1e0a4aec322761bd1f606eeabc39b37e6b9a4f523635a33be4
SSDEEP 49152:+spMRI28259LtbjsjdbVmofrZq/zPhmFyuPAfL1s2OwGNbHRtL:+4b2aux6LNbHD
TLSH
T1BCB5AF07F5FA00E9C02AC27487ABA633FA367C4A4521772F1690A6253F7BF905B5E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\icudtl.dat
Size 10.0MB
SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
MD5 3f019441588332ac8b79a3a3901a5449
SHA1 c8930e95b78deef5b7730102acd39f03965d479a
SHA512 ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9
SSDEEP 196608:gmXwSv9AAQMlptodliXUxR0rHf93WhlA6tnoB:gjKlQMlpgliXUxR0rHf93WhlA6tnoB
TLSH
T167B62846B2EB4EC2F9FBAE70D9F463675426BC016E31815946042F3B1C777E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\locales\en-US.pak
Size 75KB
SHA256 3333cf1fb2b0c15ea819787ba672d2274f3136e6a8729f2e5d2796b740688183
MD5 a2201115723fd61d1e68ab001e6cdca0
SHA1 a97073e22adf7b300e702e717743cd249e64b4fb
SHA512 e68c451602a0c2cd47ee3652daf1d74d87e6e61ebda9166cbb182301f03118b72288968695f85a1bcdefb45e4753ba7187dd5159b6694952f33238af39d89479
SSDEEP 1536:2GBj+Xuwnu0fzEphzDiQ2trhu5uBlgfSOqJedMprkhxv+fDgglgqfowv:2yqXJtzEphSBBlgm+xKgglgFwv
TLSH
T1E2734D5BE3C42235059303627A0377A6AB25E0A967521197BC9CC16C33B7FE4C2776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\resources.pak
Size 8.9MB
SHA256 7b2bccc7c2469d516116e9e9fb3ef9ee397ac98508ccd4f3f6714b7ccd1b9c3f
MD5 fc8c0d2bf591195c8a7ec32b034d3ba4
SHA1 58ada360ee3482b424a8b876446d864ba02e7b7c
SHA512 46d033b476963310fe7386e4ad764ec583d50cc1df2e91e1ae0660f50ee7bad624fa146d867659f6bdb1072f34d2baec466637233e45b5f6df05201a51049dbd
SSDEEP 98304:mOdRYaPrtXSElgA1hMoJm7bgGMy6NFfwbPPs:mOdRYaPrtnWahMWmbl6N0Pk
TLSH
T1ED967D573255103A82DA86FB64BA0603BF376046B41090BCF9ACDDCD5BEED429277B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\swiftshader\libEGL.dll
Size 392KB
SHA256 91e118f71d5605b24d58002f152fe7bfe95af85a0027076a944c62609357e16e
MD5 a686afbd8b63a663ab6af10ae14b4f38
SHA1 76f1d873233dc5a2ffd5ed8b003614825755236c
SHA512 b5307e6b254491cbc11bd18395036604ac333f65ee3d64cbd62f2f12bb615f080f1740c3e55e69e3758fa19daefcb8b9bd3cbe19956b77e7ca7a539a7c9ccae5
SSDEEP 6144:C3lNvD9dUn+x5WiqCff0vDixSx9+6ipIJqH48rrAtaWL0W:C3lNvxdUn9iqCfsFcIJqUtar
TLSH
T1FE847D16F7A048B9D067C034C9278A42DA71BCDE0F65E29F2395425E2F77BE49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\swiftshader\libGLESv2.dll
Size 3.6MB
SHA256 f1d11680aeba15d3f31fd3982da7a78b460705fd54e6033fd791e5298cdbfcd5
MD5 5d71cefb8378b025f941eba3ccf328e3
SHA1 e6de9c0de7e2c9157bbd4c01f26d2fde6f34e9f4
SHA512 65fdeda1239de431ba4694123ee136f035b21d635d1e17982690e2103d04632023c82571d467dc2fbb349eb8f36765cbaff5e0ea93bd49b64a7fb797bdd79120
SSDEEP 49152:UE8gY3DuOpn+em8kINB/2xPkhDZ0SmDxcJtaRL96Om9MQ0xehKyRGZP+mt1G3eWE:i7GkhDpoWJtaPm9MQ3cA3
TLSH
T12006E803D66F90EFE056EA35971BB332D1B578C574387976676239112BE27202B3B388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\QuickCoreQuickCore\v8_context_snapshot.bin
Size 607KB
SHA256 172d37f02295e53a548907baac6eb33b3c2acaa49c1008bae27acf3a1a0d1c1a
MD5 059c46a6c2a64b3c787d1479cd1e28a6
SHA1 93ab53fd9ffa4822a7c2bf33b3248863bef1abef
SHA512 aec0893b15e3df8c459b3d3c4710d8b0df6809f10dd3138ac0abbee1abe58743a47a31a46c327b8724a34de54b465dc6dfc24d458242cbf335dfa5805dc8a774
SSDEEP 6144:wdBNIyNEDV3VySacNOOU/coSWoiC5/8N2vEtncL+S+3:wdBuLDV3c9cL5m2oHS+3
TLSH
T181D4A454B761EF8BF336817A56C15BA036A4E0441F01BB5B53684FBD3C2FA210D29BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\is-3E96R8XY0Z.tmp\chrome_100_percent.pak
Size 175KB
SHA256 65cb11d090b32e0fb3c740a736c13c0a47cb1bcb265c084e3de5bb7474fb662f
MD5 3ff806f44723cee528a1aaee4d3a289e
SHA1 56830e7ff31f803077aed774fafebd4e6c5e6c90
SHA512 03dafb839308d644a9943ba66838536fbd1f606cafe392f90925ce51766b5e3a9064d60ca8463bacf7238258beded570d5a0007f3ce11c14f87b10faa2da2977
SSDEEP 3072:ISzwVnp8YdJtroNdX2w5+vfdYCJdx10khejSTS9SO0vVm7O0U27IIABNHlJsgfI:ISzwVSTNhx5c1YC7x10fSucY7OP2ITQ
TLSH
T1EC04D0E3B3F0AC7EE65B0A3375550B77E93B413506A30309C28689752D5AB80D9DD78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.bin.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5P3OI0DWMB.tmp\a.bin.tmp
Size 4.2MB
SHA256 40333fded8613045e139b300cd93e51d4bce22d03e22da9e57ddeeb4b32a776c
MD5 074a56a8618f885eadf42028b9b39d29
SHA1 25b05b5bcd95317de68dfc38e4dd63ec6f725530
SHA512 8ae777cb04a1160f59bdf983642f7b584dc8b3702472cddf31b311e37b6dec318ca1c85c5405e76a9948099a87d3925f165a857084cb8f82c520c6940521d6de
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Ps:7xuHjWfZIzes
TLSH
T104268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.txt

Path C:\Users\Admin\AppData\Roaming\setup.txt
Size 8B
SHA256 2cc16f01ae229ef7ce0c26b9a3604827625cd9b5ea60f0cbcedbc74e76548fdf
MD5 50b96e853907c00297d4d55b4b101d83
SHA1 3b185258c9e4feeb356e7bd3dbfda0105ee8ee3b
SHA512 37ec668d21d347e2915cc1381a6a731ea968069495f0afed265f8d5a7da1699613d987621dd3cd05fd4f450833a574aa6ac4cfc1b66f5cd7d364820fd40e1322
MD5 SHA1 SHA512

Submit Download

memory/640-312-0x00007FFD06170000-0x00007FFD06171000-memory.dmp

Download

memory/1852-5-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/1852-336-0x0000000000CA0000-0x00000000010EB000-memory.dmp

Download

memory/1852-338-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/1852-337-0x00000000010F0000-0x00000000016F2000-memory.dmp

Download

memory/2400-1-0x0000000000100000-0x00000000001E9000-memory.dmp

Download

memory/2400-335-0x0000000000100000-0x00000000001E9000-memory.dmp

Download